#VU35777 Information disclosure in Ivanti Connect Secure (formerly Pulse Connect Secure)

Published: 2019-06-28 | Updated: 2020-08-08

Vulnerability identifier: #VU35777

Vulnerability risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-20811


Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Ivanti Connect Secure (formerly Pulse Connect Secure)
Server applications / Remote access servers, VPN

Vendor: Ivanti


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

A hidden RPC service issue was found with Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2 and 8.1RX before 8.1R12.

Install update from vendor's website.

Vulnerable software versions

Ivanti Connect Secure (formerly Pulse Connect Secure): 8.1 - 8.3

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Latest bulletins with this vulnerability